Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CVE November 2024 #4933

Closed
wants to merge 16 commits into from
Closed

CVE November 2024 #4933

Changes from 1 commit
Commits
Show all changes
16 commits
Select commit Hold shift + click to select a range
4f36121
Replace alpine with jdk-slim.
jaredb96 Nov 18, 2024
74e8fce
Remove apk update.
jaredb96 Nov 18, 2024
01646c3
Revert to alpine.
jaredb96 Nov 18, 2024
92536fc
Apk upgrade commands.
jaredb96 Nov 18, 2024
b1d8873
Remove ssl add.
jaredb96 Nov 18, 2024
fffd859
Netty common update.
jaredb96 Nov 25, 2024
5b79497
Remove comment.
jaredb96 Nov 25, 2024
4debbc7
Remove netty common fix.
jaredb96 Nov 26, 2024
9dd6035
Remove netty common fix.
jaredb96 Nov 26, 2024
f218be6
Add 32.0.0-android to build.sbt (does not work).
jaredb96 Nov 29, 2024
6e94eb4
Use ThisBuild on build.sbt (does not work).
jaredb96 Nov 29, 2024
b48dd47
Add guava exclude.
jaredb96 Nov 29, 2024
a9d07ac
Correct guava version.
jaredb96 Nov 29, 2024
6c1b304
Merge branch 'master' into cve-nov-2024-release
jaredb96 Dec 2, 2024
efb2a1e
Netty common cve resolution.
jaredb96 Dec 2, 2024
5e9c53c
Keycloak cve resolution.
jaredb96 Dec 2, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion build.sbt
View file
Open in desktop
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Resolves CVE-2023-2976 and CVE-2024-21742

Original file line number Diff line number Diff line change
Expand Up @@ -67,7 +67,7 @@ lazy val dockerSettings = Seq(
dockerBaseImage := "eclipse-temurin:21.0.2_13-jdk-alpine",
dockerRepository := Some("hmda"),
dockerCommands := dockerCommands.value.flatMap {
case cmd@Cmd("FROM",_) => List(cmd, Cmd("RUN", "apk add --no-cache openssl"),
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remove here since it isn't necessary, the upgrade resolves this cve, although we could use this base image as well: eclipse-temurin:21.0.5_11-jdk-alpine

case cmd@Cmd("FROM",_) => List(cmd,
Cmd("RUN", "apk update"),
Cmd("RUN", "apk upgrade"),
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Resolves CVE-2024-5535, CVE-2024-45492, and CVE-2024-45491 - all critical cves

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This actually resolves the majority of the critical / high cves:

CVE-2024-5535 (libcrypto3, libssl3)
CVE-2024-45492, CVE-2024-45491 (libexpat)
CVE-2024-6119 (libcrypto3, libssl3)
CVE-2024-4603 (libcrypto3, libssl3)
CVE-2024-4741, CVE-2024-2511 (libcrypto3, libssl3)

Current cves:

NAME                INSTALLED       FIXED-IN                                              TYPE          VULNERABILITY        SEVERITY 
apache-mime4j-core  0.8.9           0.8.10                                                java-archive  GHSA-jw7r-rxff-gv24  Medium    
guava               31.0.1-android  32.0.0-android                                        java-archive  GHSA-7g45-4rm6-3mm3  Medium    
guava               31.0.1-android  32.0.0-android                                        java-archive  GHSA-5mg8-w23w-74h3  Low       
keycloak-core       25.0.3          25.0.4                                                java-archive  GHSA-xmmm-jw76-q7vg  Medium    
netty-common        4.1.94.Final    4.1.115                                               java-archive  GHSA-xq3w-v528-46rv  High      
openjdk             21.0.2+13-LTS   1.8.0_422, 11.0.24, 17.0.12, 21.0.4, 22.0.2, 8.0.422  binary        CVE-2024-21147       High      
openjdk             21.0.2+13-LTS   1.8.0_432, 11.0.25, 17.0.13, 21.0.5, 23.0.1, 8.0.432  binary        CVE-2024-21235       Medium    
openjdk             21.0.2+13-LTS   1.8.0_422, 11.0.24, 17.0.12, 21.0.4, 22.0.2, 8.0.422  binary        CVE-2024-21145       Medium    
openjdk             21.0.2+13-LTS   1.8.0_422, 11.0.24, 17.0.12, 21.0.4, 22.0.2, 8.0.422  binary        CVE-2024-21140       Medium    
openjdk             21.0.2+13-LTS   1.8.0_432, 11.0.25, 17.0.13, 21.0.5, 23.0.1, 8.0.432  binary        CVE-2024-21217       Low       
openjdk             21.0.2+13-LTS   1.8.0_432, 11.0.25, 17.0.13, 21.0.5, 23.0.1, 8.0.432  binary        CVE-2024-21210       Low       
openjdk             21.0.2+13-LTS   1.8.0_432, 11.0.25, 17.0.13, 21.0.5, 23.0.1, 8.0.432  binary        CVE-2024-21208       Low       
openjdk             21.0.2+13-LTS   1.8.0_422, 11.0.24, 17.0.12, 21.0.4, 22.0.2, 8.0.422  binary        CVE-2024-21138       Low       
openjdk             21.0.2+13-LTS   1.8.0_422, 11.0.24, 17.0.12, 21.0.4, 22.0.2, 8.0.422  binary        CVE-2024-21131       Low       
openjdk             21.0.2+13-LTS   1.8.0_412, 11.0.23, 17.0.11, 21.0.3, 22.0.1, 8.0.412  binary        CVE-2024-21094       Low       
openjdk             21.0.2+13-LTS   1.8.0_412, 11.0.23, 17.0.11, 21.0.3, 22.0.1, 8.0.412  binary        CVE-2024-21068       Low       
openjdk             21.0.2+13-LTS   11.0.23, 17.0.11, 21.0.3, 22.0.1                      binary        CVE-2024-21012       Low       
openjdk             21.0.2+13-LTS   1.8.0_412, 11.0.23, 17.0.11, 21.0.3, 22.0.1, 8.0.412  binary        CVE-2024-21011       Low       
zookeeper           3.8.3           3.8.4                                                 java-archive  GHSA-r978-9m6m-6gm6  Medium

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @jaredb96 ; would it be worth upgrading the base image at this point? looks like eclipse-temurin:23.0.1_11-jdk-alpine resolves all the critical CVEs (and it also seems to run an "apk update" internally). We could of course try going back a bit farther if we don't want an image pushed yesterday...

Cmd("RUN", "rm /var/cache/apk/*"))
Expand Down
Loading